Why user-scope installs are hard to inventory
Software that installs under a user profile requires no elevation, and the mechanisms that make it convenient are the same ones that make it invisible.
An application that installs entirely under %LOCALAPPDATA% never requests
elevation, never writes to the machine-wide uninstall key, and never touches a
path that a standard inventory sweep is likely to be pointed at. This is not an
exploit. It is a supported deployment pattern, and it has been for years.
The mechanics
Windows maintains uninstall information in two places:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for machine-wide
installs, and the HKCU equivalent for per-user ones. Plenty of tooling reads
the first and not the second, or reads the second only for the currently
logged-on user, which on a multi-user machine is a partial answer.
Squirrel-based installers popularised the pattern for Electron applications: unpack into a versioned directory under the user profile, register a shortcut, and self-update on launch without ever prompting. The application is then several versions ahead of whatever any inventory recorded, assuming anything recorded it.
Why the usual controls do not close it
Privilege management operates on elevation. An install that never requests elevation presents nothing to gate. That is not a defect in the product: it is the boundary the product is designed to enforce, and the install simply sits outside it.
Distribution-channel controls have the same shape. Restricting the Microsoft Store closes the Store. It does not close a direct download, and the file that arrives does not need any channel-level permission to unpack itself into a directory the user already owns.
What actually helps
The reliable approach is to stop treating installation as the observable event and start treating the file on disk as the observable. An executable under a user profile is a fact you can establish directly, independently of whether any installer registered it, which channel delivered it, or whether elevation was ever requested.
That reframing is the entire difference between an inventory that reflects what was deployed and one that reflects what is present.
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.